跳到正文
SecondTuesday

补丁日：2026年7月

发布于 2026年7月14日 · 22 条安全说明 · 来源：SAP 安全补丁日页面

计划日期：2026年7月14日（每月第二个星期二）

新发布
18
更新
4
严重
4
高
7
最高 CVSS
9.9
已被利用
0

本月摘要

共 22 条安全说明（新发布 18 条，更新 4 条），其中严重 4 条、高 7 条，最高 CVSS 9.9。

优先修补

排序依据：是否已知被利用（CISA KEV），其次是 SAP 优先级，再次是 CVSS 分数。仅供分诊参考，不能替代您自己的风险评估。

  1. 3747367严重CVSS 9.9

    Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP

  2. 3720138严重CVSS 9.1

    HTTP Request Smuggling in SAP Approuter

  3. 3753495严重CVSS 9.1

    Insecure Sample Credentials in SAP Commerce Cloud

  4. 3727078严重CVSS 9.0

    Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)

  5. 3758101高CVSS 8.8

    Multiple vulnerabilities in Apache Camel within SAP Integration Suite (Edge Integration Cell)

全部安全说明

SAP 简介中写明 16 条新安全说明和 3 条更新；SAP 表格共列出 22 行（两者可能不同，例如包含 GitHub 安全公告或补发条目）。

SAP 公告中的最高优先级在 2024 年 12 月及以前标为 “Hot News”，自 2024 年 10 月起标为 “Critical”；本站统一显示为“严重”。

显示 22 / 22

标题CVE
3747367
Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP
新发布
SAP NetWeaver AS ABAP / ABAP Platform严重9.9CVE-2026-44747
3720138
HTTP Request Smuggling in SAP Approuter
新发布
SAP Approuter严重9.1CVE-2026-27690
3753495
Insecure Sample Credentials in SAP Commerce Cloud
新发布
SAP Commerce Cloud严重9.1CVE-2026-44761
3727078
Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)
更新
SAP NetWeaver AS Java严重9.0CVE-2026-40128
3758101
Multiple vulnerabilities in Apache Camel within SAP Integration Suite (Edge Integration Cell)
新发布
SAP Integration Suite高8.8CVE-2026-40860, CVE-2026-40453, CVE-2026-33454
3692165
DLL Hijacking vulnerability in SAProuter on Microsoft Windows
新发布
SAProuter on Microsoft Windows高8.4CVE-2026-0487
3732471
OS Command Injection Vulnerability in SAP Forecasting & Replenishment
更新
SAP Forecasting & Replenishment高8.2CVE-2026-34259
3748227
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard)
新发布
SAP NetWeaver AS Java高8.2CVE-2026-44752
3741519
Open Redirect vulnerability in SAP Approuter
新发布
SAP Approuter高8.1CVE-2026-44745
3763800
Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud
新发布
SAP Commerce Cloud高8.1CVE-2026-43512, CVE-2026-41293, CVE-2026-43515
3773304
Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)
新发布
SAP Change and Transport System Attach Tool高7.6CVE-2026-58233
3746678
Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
新发布
SAP NetWeaver Enterprise Portal中6.1CVE-2026-44759
GHSA-p8gx-753q-v89p
Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection
新发布
ui5/webcomponents-base中6.1CVE-2026-44767
3537373
SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO)
新发布
SAP S/4HANA Project Management中5.5CVE-2026-44769
3754659
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages)
新发布
SAP NetWeaver AS ABAP / ABAP Platform中4.7CVE-2026-44760
3413033
Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
新发布
SAP NetWeaver AS ABAP / ABAP Platform中4.3CVE-2026-58246
3515598
Missing Authorization check in SAP S/4HANA (Draft operation)
新发布
SAP S/4HANA中4.3CVE-2026-44771
3713902
Missing Authorization check in SAP S/4 HANA (Create Single Payment)
新发布
SAP S/4HANA中4.3CVE-2026-44770
3682699
Path Traversal Vulnerability in SAP Fiori (launchpad)
更新
SAP Fiori中4.2CVE-2026-24315
3155685
Security misconfiguration in SAP CRM (WebClient UI)
新发布
SAP CRM中4.1CVE-2026-44768
3732522
Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service)
新发布
SAP HANA Extended Application Services classic model低3.7CVE-2026-44753
3726899
Potential vulnerability in Apache Log4j library used by SAP NetWeaver AS Java
更新
SAP NetWeaver AS Java低3.3CVE-2025-68161